Home > Perform Exchange Online Migrations > Required Permissions for Exchange Online Migration > Permissions for Source Exchange Online
Export to PDFPermissions for Source Exchange Online
To connect to the source, you can choose to only use a service account, Fly app profile, or custom app profile as the authentication method. You can also use the combination of a service account and a Fly app profile, or the combination of a service account and a custom app profile.
Refer to the following sections to view the permissions required by the authentication methods.
Fly App Profile Permissions
With the Tenant Owner or Service Administrator role, you can create a Fly app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using the Fly app.
Refer to Fly App Profile Permissions about how to create a Fly app profile and required permissions of the Fly app profile.
Note the following:
Custom App Profile Permissions
With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.
Refer to the following procedures to create a custom app profile:
-
Prepare a certificate in Microsoft Entra ID. Refer to for more information.
You can ignore this step if you have a certificate.
-
Create a custom Azure app in Microsoft Entra ID. Refer to for more information.
-
.
-
in AvePoint Online Services.
*Note: After you re-authorize the app profile, you need to wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated.
Migration to Exchange Online
Refer to the following tables to add API permissions required by Exchange Online to Exchange Online migrations.
Note the following:
| API | Permission | Type | Purpose |
|---|---|---|---|
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | Content.SuperUser(Read all protected content for this tenant) | Application | Only required if you want to manage sensitivity labels of emails. |
| Microsoft Information Protection Sync Service | UnifiedPolicy.Tenant.Read(Read all unified policies of the tenant) | Application | Only required if you want to manage sensitivity labels of emails. |
| Office 365 Exchange Online | Exchange.ManageAsApp(Manage Exchange As Application) | Application | Use Exchange PowerShell to migrate mailbox permissions, distribution lists, and dynamic distribution lists. |
| Office 365 Exchange Online | full_access_as_app(Use Exchange Web Services with full access to all mailboxes) | Application | Retrieve and migrate items from all mailboxes.*Note: If you do not want to add this permission to the app, you can create an RBAC assignment for the app to only access to specified mailboxes. Refer to the option 3 in the How to Migrate Mailboxes without the ApplicationImpersonation Role? section for details. |
| Microsoft Graph | Directory.Read.All (Read directory data) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | Group.Read.All(Read all groups) | Application | Retrieve Microsoft Groups and group owners. |
| Microsoft Graph | OnlineMeetings.ReadWrite.All(Read and create online meetings) | Application | Make sure the replaced meeting links in the destination are available to all attendees. |
| Microsoft Graph | Reports.Read.All(Read all usage reports) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | ReportSettings.Read.All(Read all admin report settings) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | User.Read.All(Read all users’ full profiles) | Application | Retrieve mailbox types to replace meeting links. |
For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.
"requiredResourceAccess": [
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "5b567255-7703-4780-807c-7be8301ae99b",
"type": "Role"
},
{
"id": "df021288-bdef-4463-88db-98f22de89214",
"type": "Role"
},
{
"id": "230c1aed-a721-4c5d-9cb4-a90514e508ef",
"type": "Role"
},
{
"id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
"type": "Role"
},
{
"id": "b8bb2037-6e08-44ac-a4ea-4674e010e2a4",
"type": "Role"
},
{
"id": "ee353f83-55ef-4b78-82da-555bfa2b4b95",
"type": "Role"
}
]
},
{
"resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
"type": "Role"
},
{
"id": "dc50a0fb-09a3-484d-be87-e023b12c6440",
"type": "Role"
}
]
},
{
"resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
"resourceAccess": [
{
"id": "8b2071cd-015a-4025-8052-1c0dba2d3f64",
"type": "Role"
}
]
},
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
"type": "Role"
}
]
}
],
Migration to Gmail
Refer to the following tables to add API permissions required by Exchange Online to Gmail migrations.
Note the following:
| API | Permission | Type | Purpose |
|---|---|---|---|
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | Content.SuperUser(Read all protected content for this tenant) | Application | Only required if you want to manage sensitivity labels of emails. |
| Microsoft Information Protection Sync Service | UnifiedPolicy.Tenant.Read(Read all unified policies of the tenant) | Application | Only required if you want to manage sensitivity labels of emails. |
| Office 365 Exchange Online | Exchange.ManageAsApp(Manage Exchange As Application) | Application | Use Exchange PowerShell to migrate mailbox permissions. |
| Office 365 Exchange Online | full_access_as_app(Use Exchange Web Services with full access to all mailboxes) | Application | Retrieve and migrate items from all mailboxes.*Note: If you do not want to add this permission to the app, you can create an RBAC assignment for the app to only access to specified mailboxes. Refer to the option 3 in the How to Migrate Mailboxes without the ApplicationImpersonation Role? section for details. |
| Microsoft Graph | Directory.Read.All (Read directory data) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | Group.Read.All(Read all groups) | Application | Retrieve Microsoft Groups and group owners. |
| Microsoft Graph | Reports.Read.All(Read all usage reports) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | ReportSettings.Read.All(Read all admin report settings) | Application | Only required if you want to run Exchange Online tenant discovery. |
| Microsoft Graph | User.Read.All(Read all users’ full profiles) | Application | Retrieve user profiles. |
For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.
"requiredResourceAccess": [
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "5b567255-7703-4780-807c-7be8301ae99b",
"type": "Role"
},
{
"id": "df021288-bdef-4463-88db-98f22de89214",
"type": "Role"
},
{
"id": "230c1aed-a721-4c5d-9cb4-a90514e508ef",
"type": "Role"
},
{
"id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
"type": "Role"
},
{
"id": "ee353f83-55ef-4b78-82da-555bfa2b4b95",
"type": "Role"
}
]
},
{
"resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
"type": "Role"
},
{
"id": "dc50a0fb-09a3-484d-be87-e023b12c6440",
"type": "Role"
}
]
},
{
"resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
"resourceAccess": [
{
"id": "8b2071cd-015a-4025-8052-1c0dba2d3f64",
"type": "Role"
}
]
},
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
"type": "Role"
}
]
}
],
Service Account Permissions
The Tenant Owner and Service Administrators can also for Microsoft 365 to connect AvePoint Online Services to your Microsoft 365 tenant.
*Note: Users with Multi-Factor Authentication (MFA) enabled cannot be used as the service account to perform migrations. You can use a delegated app profile instead.
Make sure the service account has a mailbox (either by assigning the Exchange license or using PowerShell to create a mailbox) and also meets the following requirements:
*Note: To make sure the source service account has a mailbox, go to the Microsoft 365 admin center > Users > Active users, and select Exchange Online under the Licenses and apps tab of the service account.
Migration to Exchange Online
Refer to the following tables for the permissions required by Exchange Online to Exchange Online migrations.
| Required Permission | Note |
|---|---|
| Full Access permission to source mailboxes in the migration | Microsoft has announced the retirement of the ApplicationImpersonation role in Exchange Online. Refer to Impact and Solutions for the Retirement of the ApplicationImpersonation Role in Exchange Online for details.If you do not migrate Group mailboxes in the migration, you can grant the Full Access permission without adding the ApplicationImpersonation role. |
| Distribution Groups role | Required if you want to migrate distribution lists or dynamic distribution lists. |
| Mail Recipients role | Retrieve mailboxes when migrating mailbox permissions, migrating mailbox aliases, performing email forwarding, etc. |
| Super user role of the organization | Refer to Assign service account as super user for details. Required if you want to manage sensitivity labels. |
What permissions are required if I also use an app profile?
If you use both service account and app profile authentications for the source Exchange Online, some service account permissions will not be required. Make sure the service account has a mailbox and the following permissions:
*Note: To make sure the source service account has a mailbox, go to the Microsoft 365 admin center > Users > Active users, and select Exchange Online under the Licenses and apps tab of the service account.
| Source Service Account Permissions | Note |
|---|---|
| Distribution Groups role | Only required if you want to migrate to distribution lists/dynamic distribution lists/mail-enabled security groups. |
| Mail Recipients role | Retrieve mailboxes when migrating mailbox permissions, migrating mailbox aliases, performing email forwarding, etc. |
Migration to Gmail
Refer to the following tables to for the permissions required by Exchange Online to Gmail migrations.
| Required Permission | Note |
|---|---|
| Full Access permission to source mailboxes in the migration | Microsoft has announced the retirement of the ApplicationImpersonation role in Exchange Online. Refer to Impact and Solutions for the Retirement of the ApplicationImpersonation Role in Exchange Online for details. If you do not migrate Group mailboxes in the migration, you can grant the Full Access permission without adding the ApplicationImpersonation role. |
| Mail Recipients role | Retrieve mailboxes when migrating mailbox permissions. |
| Super user role of the organization | Refer to Assign service account as super user for details. Required if you want to manage sensitivity labels. |
What permissions are required if I also use an app profile?
If you use both service account and app profile authentications for the source Exchange Online, some service account permissions will not be required. Make sure the service account has a mailbox and the following permissions:
*Note: To make sure the source service account has a mailbox, go to the Microsoft 365 admin center > Users > Active users, and select Exchange Online under the Licenses and apps tab of the service account.
| Source Service Account Permissions | Note |
|---|---|
| Mail Recipients role | Retrieve mailboxes when migrating mailbox permissions. |
Delegated App Profile Permissions
Fly allows you to use the Fly delegated app profile or custom delegated app profile to connect to your workspace.
To use a delegated app profile, note the following:
To use the Fly delegated app profile with required permissions, refer to Fly Delegated App Profile Permissions.
To use a custom delegated app profile with required permissions, refer to the following steps:
-
After registering an app in Microsoft Entra ID, add the required permissions to the app. The sections below show the required permissions of a custom app.
-
Click Authentication in the left navigation of the app.
-
Click Add a platform.
-
Select Web in the Configure platforms panel.
-
In the Configure Web panel, enter the AvePoint Online Services URL: https://www.avepointonlineservices.com for your commercial environment or https://usgov.avepointonlineservices.com for your U.S. Government environment in the Redirect URIs field.
-
-
Click Configure.
-
Select the Access tokens and ID tokens checkboxes on the Authentication page.
-
Click Save.
-
Create an app profile for the app using the Custom mode in AvePoint Online Services by referring to .
*Note: When consenting to the app, if you have granted the admin consent and allowed public client flows for the permissions, you can choose to use the Global Administrator consent or the User consent method. If not, you can only use the Global Administrator consent method.
Custom Delegated App Profile Permissions when Migrating to Exchange Online
Make sure the custom delegated app profile has the following permissions.
| API | Permission | Type | Purpose |
|---|---|---|---|
| Office 365 Exchange Online | EWS.AccessAsUser.All(Access mailboxes as the signed-in user via Exchange Web Services) | Delegated | Access specified user and export data. |
| Office 365 Exchange Online | Exchange.Manage(Manage Exchange configuration) | Delegated | Use Exchange PowerShell to migrate mailbox permissions, distribution lists, and dynamic distribution lists. |
| Microsoft Graph | Group.Read.All(Read all groups) | Delegated | Retrieve Microsoft Groups and group owners. |
| Microsoft Graph | User.Read.All(Read all users' full profiles) | Delegated | Retrieve mailbox types to replace meeting links. |
| Microsoft Information Protection Sync Service | UnifiedPolicy.User.Read(Read all unified policies a user has access to) | Delegated | Only required if you want to manage sensitivity labels of emails. |
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | user_impersonation(Create and access protected content for users) | Delegated | Only required if you want to manage sensitivity labels of emails. |
For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.
"requiredResourceAccess": [
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
"type": "Scope"
}
]
},
{
"resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
"resourceAccess": [
{
"id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
"type": "Scope"
}
]
},
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
"type": "Scope"
},
{
"id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
"type": "Scope"
}
]
},
{
"resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
"type": "Scope"
},
{
"id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
"type": "Scope"
}
]
}
],
Custom Delegated App Profile Permissions when Migrating to Gmail
Make sure the custom delegated app profile has the following permissions.
| API | Permission | Type | Purpose |
|---|---|---|---|
| Office 365 Exchange Online | EWS.AccessAsUser.All(Access mailboxes as the signed-in user via Exchange Web Services) | Delegated | Access specified user and export data. |
| Office 365 Exchange Online | Exchange.Manage(Manage Exchange configuration) | Delegated | Use Exchange PowerShell to migrate mailbox permissions. |
| Microsoft Graph | Group.Read.All(Read all groups) | Delegated | Retrieve Microsoft Groups and group owners. |
| Microsoft Graph | User.Read.All(Read all users' full profiles) | Delegated | Retrieve user profiles. |
| Microsoft Information Protection Sync Service | UnifiedPolicy.User.Read(Read all unified policies a user has access to) | Delegated | Only required if you want to manage sensitivity labels of emails. |
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | user_impersonation(Create and access protected content for users) | Delegated | Only required if you want to manage sensitivity labels of emails. |
For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.
"requiredResourceAccess": [
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
"type": "Scope"
}
]
},
{
"resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
"resourceAccess": [
{
"id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
"type": "Scope"
}
]
},
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
"type": "Scope"
},
{
"id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
"type": "Scope"
}
]
},
{
"resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
"type": "Scope"
},
{
"id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
"type": "Scope"
}
]
}
],